Privacy and Data Protection Policy

This Policy describes the criteria used by RPSIGN when processing personal data connected with the public website and authorised use of the platform. It is intended to explain what may be collected, why processing occurs, which legal grounds may apply, how information may be shared or retained, and which rights are available to individuals.

The public website is institutional and informational. Operational access is restricted to relationships and signature workflows authorised by RPSIGN. Visiting the website does not automatically create an account, open the service for public contracting or submit documents to a signature process.

RPSIGN operates in Brazil and uses Brazilian Law No. 13,709/2018 (LGPD) and other applicable Brazilian rules as its primary legal reference. A feature described as conditional is only subject to this Policy when it is actually enabled and used.

Personal data

Information relating to an identified or identifiable natural person.

Sensitive personal data

Data receiving enhanced protection under the LGPD, including biometric data linked to an individual.

Data subject

The natural person to whom personal data relates.

Processing

Any operation involving personal data, including collection, access, storage, use, disclosure or deletion.

Controller

The person or entity responsible for essential decisions on purposes and means of processing.

Processor

A person or entity processing personal data on behalf of and under the instructions of a controller.

Workflow

The set of stages linking a document, participants, applicable policy, authentication, expression of intent and technical evidence.

Participant

A person associated with a workflow, such as a signer, representative, witness, reviewer or recipient.

RPSIGN is the controller of personal data processed within its operation because it determines the essential purposes, access rules and criteria for use. While the formal corporate registration is being completed, this Policy identifies the controller under the institutional name RPSIGN; the formal legal name and Brazilian company registration number should be added when available.

ADDON — Inteligência, Software e Automação developed the technology. Software development alone does not automatically make ADDON a controller or processor. Its legal role depends on the activities actually performed. If technical support involves access to personal data on RPSIGN's instructions, that access must be limited to what is necessary and subject to the applicable obligations.

Other technical providers may act as processors or sub-processors when they perform hosting, e-mail, anti-abuse, storage, authentication or another contracted function on behalf of RPSIGN.

The amount and nature of data depend on the person's relationship with RPSIGN. A visitor sending a contact request provides substantially less information than a participant in a signature workflow. RPSIGN seeks to process only data reasonably necessary for the relevant purpose.

Data provided directly

This may include name, e-mail address, telephone number, contact-message content, identification details required for authorised access, participant details and information contained in documents.

Technical and security data

This may include IP address, date and time, browser/user-agent information, session identifiers, authentication events, access attempts and security logs used to prevent abuse, investigate failures and preserve evidence of relevant events.

Workflow data

This may include envelope identifiers, document versions, participant roles, event order, workflow status, recorded expressions of intent, hashes and technical evidence actually produced by the selected method.

Enhanced identity-verification data

Identity documents, geolocation, selfie, liveness or biometric information are not described as universally active features. Such data should only be processed if the relevant mechanism is actually enabled, demonstrably necessary and supported by an appropriate legal basis and safeguards.

RPSIGN does not rely on a single blanket legal basis. The appropriate ground depends on the concrete purpose, relationship and nature of the data. The following table summarises the main scenarios under the Brazilian LGPD framework.

Consent is used only where it is an appropriate ground for a specific purpose. It is not treated as a general authorisation for any future use. RPSIGN does not use website data for behavioural advertising, marketing profiling or sale of personal-data databases.

A document may contain information about people other than the person who uploaded it, including signers, representatives, witnesses, contracting parties, attorneys or other individuals named in the instrument. The person who creates or manages the workflow must have a legitimate basis for using those data and disclosing the document to the intended participants.

Use of RPSIGN does not make an otherwise unlawful disclosure lawful. Where a document is subject to professional secrecy, contractual confidentiality, trade secrecy or another duty of reservation, the sender must assess whether the document and participant list are compatible with those duties.

Document content is not used for behavioural advertising, commercial profiling or sale of information. Exceptional technical access should be tied to requested support, security, incident investigation, compliance with law or exercise of legal rights, and limited to what is necessary.

Authentication data and evidence depend on the method actually used in a workflow. Depending on availability and policy, a workflow may use e-mail, one-time codes, mobile channels, technical device data, digital certificates or other controls. Combining several controls is not an absolute guarantee of identity and does not automatically determine a legal signature category.

RPSIGN's integrity architecture may link events to SHA-256 hashes and an organisational ledger. Hash chaining helps reveal inconsistencies with the recorded chain, while HMAC-SHA-256 authenticated checkpoints reinforce internal verification. Those controls are not, by themselves, an ICP-Brasil digital signature, a trusted timestamp or absolute protection against a total compromise of all infrastructure and secrets.

Any future completion certificate or audit report should reflect only the evidence actually generated in the workflow and should not be represented as a notarial authentication, digital certificate or independent expert report.

The institutional website currently uses only technical mechanisms required for operation, language preference, accessibility, form security and, where an authenticated area is available, session management. It does not currently use marketing, advertising or behavioural-tracking cookies.

• The cookie notice stores the “Understood” acknowledgement in sessionStorage for the current browser tab.
• An authenticated area may use an essential session cookie while the session is active.
• The contact form uses Cloudflare Turnstile as an anti-abuse mechanism; its technical token is verified server-side.
• The server may temporarily store an IP-derived identifier to limit abusive attempts and message submissions.

The acknowledgement button records awareness of the notice rather than consent to advertising tracking. If non-essential cookies are introduced later, choice controls must be reviewed before activation.

RPSIGN seeks to avoid unnecessary disclosure. Data may be made available to providers only where a technical function requires it, such as hosting, e-mail, anti-abuse protection, storage, support, authentication or a digital-signature component that is actually contracted and enabled.

Disclosure may also occur to comply with law, a valid court order or competent authority request; to protect rights; or to investigate incidents and prevent fraud. Whenever possible, disclosure should be limited to information relevant to the particular purpose.

RPSIGN does not sell personal data to advertisers and does not authorise providers to repurpose information for unrelated uses.

Infrastructure providers may operate servers, support or processing activities outside Brazil. Where personal data is transferred internationally, RPSIGN should consider the LGPD requirements, the purpose of processing, provider safeguards and the legally appropriate transfer mechanism.

The use of a foreign provider does not authorise unlimited processing. Any international transfer remains tied to the contracted technical purpose and should be subject to proportionate access and security controls.

RPSIGN does not apply one identical retention period to all information. Contact records, security logs, documents and evidence serve different purposes. Retention should take account of operational necessity, legal obligations, exercise of rights, fraud prevention, limitation periods and the legitimate need to demonstrate past events.

Contact messages should be retained only as long as reasonably necessary for service and institutional history. Anti-abuse records may have short retention. Documents and evidence may require longer preservation where needed to demonstrate existence, integrity or sequence of a workflow.

When the purpose ends and no legal ground remains, data should be deleted, anonymised or otherwise handled as permitted by the LGPD. A deletion request does not automatically override a legal or legitimate duty to retain particular records.

RPSIGN follows a layered-security approach. Controls already incorporated into the administrative architecture include TOTP multi-factor authentication, secure sessions, deny-by-default role-based access control, organisational isolation, private storage, versioned policies and integrity mechanisms. These controls reduce risk but do not justify claims of invulnerability or complete absence of incidents.

Administrative-account security and signer identification serve different purposes. Strong administrator authentication does not itself prove the identity of a signer in a specific document. Users are also expected to protect credentials, devices and access links.

Suspected unauthorised access, disclosure, incompatible alteration or material unavailability should be assessed to contain the event, preserve evidence, understand impact and adopt corrective measures. Where Brazilian law requires notification to individuals or the Brazilian Data Protection Authority (ANPD), the decision must follow the applicable legal and regulatory criteria.

Under the LGPD, data subjects may, where applicable, request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability within regulatory limits, information about sharing, withdrawal of consent where consent is the relevant basis and review of certain automated decisions where applicable.

RPSIGN may request reasonable identity verification before disclosing, altering or deleting data in order to avoid acting on a fraudulent request. Additional information should be limited to what is necessary to validate the requester. If a request cannot be fulfilled because a lawful retention or restriction applies, the reason should be explained.

Requests may be submitted through the institutional contact form. Sensitive documents should not be sent through the initial contact channel unless specifically instructed.

This Policy may be updated to reflect legal, regulatory, technical or operational changes. The latest revision date will remain visible at the beginning. Material changes affecting the nature of processing should be communicated through an appropriate channel where required.

RPSIGN is a Brazilian operation and this Policy is interpreted primarily under Brazilian law, especially the LGPD. This English translation is provided for accessibility and convenience. In case of interpretative divergence, the Brazilian Portuguese version is the reference, without prejudice to mandatory rules that may apply in a particular case.

Privacy or data-protection questions may be sent through the RPSIGN contact channel.